0

So I know that there is not a definitive answer for this question, but I am curious to see what others might know about this subject. The company I work for sees a lot of external network sweeps, and also attempted POST and GET requests to our customer facing website. Although I am able to see that nothing malicious has occurred (other than the attempt), I am curious to know the following:

  1. Whether or not a 301 OR 404 HTTP/1.1 response to a malicious attackers POST or GET request actually stops them from 'posting' or 'getting'?

  2. Can these response codes inevitably help the attacker out?

  3. Are there better ways to have servers response to external request (how?)?

References are highly appreciated!

  • Did you try doing the same thing to see what kind of response you (from the attacker's perspective) get? What headers they see, exactly what bytes they'll receive, how long it takes, etc. [Not an answer, and won't provide any sort of aha moment; just a perspective shift to help you think about the problem differently.] – drewbenn Aug 15 '16 at 23:20
  • Thanks for the response Poly. Yes I tried that before I asked on this forum and wasn't able to get anything of value (from an attackers perspective). To give you some context, our DMZ gets swept pretty regularly, and in this instance, a GET request was able to go through one of our VIPs after a previous request from the same IP (same request as well) was blocked - so it made me wonder if anyone else knew how you can manipulate those responses – Tyler Gallenbeck Aug 18 '16 at 20:16
1

Whether or not a 301 OR 404 HTTP/1.1 response to a malicious attackers POST or GET request actually stops them from 'posting' or 'getting'?

The "attacker" sends a post request to the server, the server receives the request and responds to it with a code and maybe some content.

For a 404 code for instance, it's a common practice to send an html page with the 404 error as well.

What the server does with the request upon receiving it depends on the server. If the POST request was to insert a record in a database the server could very well insert the record in the db and then reply with a 404.

It would be a crappy implementation, but it can certainly be done.

Can these response codes inevitably help the attacker out?

Of course. The response usually contains headers with information about the server. Even if you disable the headers, the response can be used to obtain information about your server with fingerprinting techniques.

How helpful this information is will very much depend on context.

Are there better ways to have servers response to external request (how?)?

I'm not sure what you're asking here. You can disable certain headers, try to fool fingerprinting software like nmap, and a myriad other measures that would change how the servers respond and maybe improve protection.

But you're going at it backwards. First define what the threat you're defending against is. Once you have that you can easily evaluate the effectiveness of the different protection measures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.